Privacy Policy

Last updated 31 March 2025

Introduction

Oxford Brain Diagnostics respects the privacy of its customers, suppliers, and partners. We have therefore formulated and implemented a policy on complete transparency regarding the processing of personal data, its purpose(s) and the possibilities to exercise your legal rights in the best possible way. For employees, we have formulated a separate privacy policy, available upon employment and upon request.

This privacy policy pertains to processing by Oxford Brain Diagnostics by means other than through the use of cookies. Oxford Brain Diagnostics has formulated a separate cookie policy, which can be found on Oxford Brain Diagnostics' website: https://www.oxfordbraindiagnostics.com.

Definitions

  • Party responsible for processing personal data: Oxford Brain Diagnostics; with registered address at 3 Kings Meadow, Osney Mead, Ferry Hinksey Road, Oxford, OX2 0DP, United Kingdom; company registration number 11703979 and Data Protection Officer Terry Pollard, who can be reached at terry.pollard@oxfordbraindiagnostics.com (the “Controller”).
  • Data Protection Authority: The Data Protection Authority of United Kingdom.
  • Data Protection laws:
    • For European citizens or residents, the EU GDPR 2018; the EU e-privacy directive 2002 (soon to be replaced by the EU e-privacy regulation);
    • For UK citizens or residents, the UK GDPR 2020, and the UK Data Protection Act 2018;
    • and the national laws of the countries where we operate.
  • Identifiable natural person: natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Personal data: any information relating to an identified or identifiable natural person (“data subject”).

Collection of data

Your personal data will be collected by Oxford Brain Diagnostics and its data processors.

 

The types of personal data we may process through third party applications and suppliers
Business Process Data Legal Basis
Marketing Email Address, First Name, Last Name, Telephone Number, Work Address Legitimate Interests
CRM Email Address, First Name, Last Name, Telephone Number, Work Address; contracts and agreements between the Controller and its clients

Data Subject Consent

Legitimate Interests
Document Storage Contracts and agreements between the Controller and its clients Data Subject Consent
Email Email Address, First Name, Last Name, Job Title, Telephone Number, Photographs, Message Sent by Data Subjects Data Subject Consent
Appointment Scheduling Tool Email Address Data Subject Consent
Application Hosting Age, Date of Birth, Gender, Medical tracking (e.g. blood pressure; blood values), Medicines, Medical Condition, Non-PII data, Medical History, General Health Data

Contract Performance

Data Subject Consent

 

Purposes

Oxford Brain Diagnostics processes personal data for one or more of the following purposes:

  • Customer, employee, contractor, partner or supplier management
  • Business and financial administration
  • Direct marketing
  • Delivery of goods or services
  • Work planning

 

How we collect, store or otherwise process your data

The following business processes describe how we may collect, store or otherwise process the types of personal
information:

  • Collection of cookies, subscription to newsletter or filling out forms on the website;
  • Analyse trends and profiles, for our legitimate interest to aim to enhance, modify, personalise and improve our services and communications for the benefit of our customers;
  • Process and respond to support requests, enquiries and complaints received from you through use of business email;
  • Provide services and products requested and/or purchased by you and to communicate with you about such services and/or products. We do this as necessary in order to carry out a contract with you and in accordance with our legitimate interest to operate a business;
  • Carry out administrative activities such as invoicing and collecting payments either locally on devices or using cloud-services;
  • Store and exchange personal information contained in documents through email and cloud-services;
  • Marketing and customer acquisition through email or using cloud-services.

Sharing data with third parties

We may have to share your data with third parties, including third-party service providers. We require third parties to respect the security of your data and to treat it in accordance with the law.

We may transfer your Personal Data outside United Kingdom. If we do, you can expect a similar degree of protection in respect of your Personal Data.

We will only share your Personal Data with third parties in accordance with the GDPR and as outlined in the legal justification table above.

We share your personal data with the following enterprise third parties. We also share your data with SME third parties, details of which are available upon request. You will be notified when we have engaged with a new third party recipient of your personal data.

 

AWS

Function Application Hosting
Data categories Age or Age Group, Date of Birth, Gender, General Health Data, Medical Condition, Medical History, Medical tracking (e.g. blood pressure; blood values), Medicines, Non-PII data
Data subjects Patients
Security measures Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g. SSL); Data is minimized and regularly deleted according to national retention periods.

 

Google Cloud

Function Data Storage
Data categories Age or Age Group, Date of Birth, Gender, General Health Data, Medical Condition, Medical History, Medical tracking (e.g. blood pressure; blood values), Medicines, Non-PII data
Data subjects Patients
Security measures Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g. SSL); Data is minimized and regularly deleted according to national retention periods.

 

Microsoft Outlook

Function Email
Data categories Email Address, First Name, Last Name, Job Title, Telephone Number, Photographs, Messages Sent by Data Subjects
Data subjects Customers, Suppliers, Partners
Security measures Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g. SSL); Data is minimized and regularly deleted according to national retention periods.

 

Microsoft Sharepoint

Function Document Storage
Data categories

Patients - Age or Age Group, Date of Birth, Gender, General Health Data, Medical Condition, Medical History, Medical tracking (e.g. blood pressure; blood values), Medicines, Non-PII data

Customers, Suppliers, Partners – Contracts between the Controller and data subjects
Data subjects Patients, Customers, Suppliers, Partners
Security measures Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g. SSL); Data is minimized and regularly deleted according to national retention periods.

 

Redbrick AI

Function Medical Image Annotation
Data categories Medical Images
Data subjects Patients
Security measures Dedicated GDPR Compliance Policy, which outlines internal procedures for improved data protection practices, an incident response plan, procedures for Data Subject Access Requests, among other things; Designation of a Data Protection Officer; Designation of a Local EU Representative; Designation of a Lead Supervisory Authority; Establishment of GDPR-specific employee training, to be completed annually; Completed Data Protection Impact Assessment; Support for international data transfers by executing Standard Contractual Clauses through our updated Data Processing Addendum; Monitor the guidance around GDPR compliance from privacy-related regulatory bodies, and update our product features and contractual commitments accordingly.

 

Xero

Function Accounting, Bookkeeping
Data categories Invoices
Data subjects Customers
Security measures Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g. SSL); Data is minimized and regularly deleted according to national retention periods.

 

Zoho

Function CRM
Data categories Contracts, Email Address,First Name, Last Name, Telephone Number, Work Address
Data subjects Customers
Security measures Physical security such as access controls, clean desk policy and CCTV; Access controls and prevention of unauthorised access on the basis of roles and strong authentication methods; All data is encrypted at rest and access is only permitted via encrypted channels (e.g. SSL); Data is minimized and regularly deleted according to national retention periods.

 

International data transfers

The third parties we have engaged for the abovementioned business process may transfer your personal information to outside of your jurisdiction. Oxford Brain Diagnostics' third party processors take all necessary measures to ensure the confidentiality, availability and integrity of personal data and to comply with the GDPR with regards to international data transfers. The international nature of its compliance certifications, as well as far-reaching technical security measures (including but not limited to encryption of the personal data, making the data illegible to an unauthorised recipient) are sufficient to ensure that the data subjects continue to benefit from the fundamental rights they are entitled to under the GDPR.

Where Oxford Brain Diagnostics transfers data to third countries, it relies on the following legal grounds for international data transfers:

  • An Adequacy Decision in accordance with article 45 of the GDPR
  • In the absence of an Adequacy Decision, appropriate safeguards in the form of Standard Contractual Clauses or Binding Corporate Rules.


In the event that Oxford Brain Diagnostics is reliant on Standard Contractual Clauses for the legality of its international data transfer, it ensures that the Processor or Subprocessor takes supplementary security measures to safeguard the international data transfer with one or more of the following measures:

  • Encryption;
  • Anonymisation;
  • Pseudonymisation.

 

Storage and protection of data

Your data is protected by Oxford Brain Diagnostics and its processors in pursuance to all legal requirements set by the relevant data processing laws. Oxford Brain Diagnostics has taken technical and organizational security measures to protect your data and requires its data processors to meet the same requirements. Oxford Brain Diagnostics has signed processing agreements with its processors to ensure an adequate level of data protection.

The following security measures are taken by Oxford Brain Diagnostics to protect your personal data in the course of the listed business processes:

 

Organisational security measures
Staff

Oxford Brain Diagnostics staff members are required to conduct themselves in a manner consistent with Oxford Brain Diagnostics' guidelines regarding confidentiality, business ethics, appropriate usage, and professional standards. All staff members undergo appropriate background checks prior to hiring and sign a confidentiality
agreement outlining their responsibility in protecting customer data.

We continuously train staff members on best security practices, including how to identify social hacks, phishing scams, and hackers.

 

Access controls

Oxford Brain Diagnostics maintains your data privacy by allowing only authorized individuals access to information when it is critical to complete tasks for you. Oxford Brain Diagnostics staff members will not process customer data without authorization.

 

Data Hosting

As a rule, data is hosted within countries and areas that provide a substantially similar level of protection as data subjects have under the GDPR. To ensure this, we rely on Adequacy Decisions as a legal basis for our international data transfers. In exceptional circumstances, where data is transferred to a country or area not subject to an Adequacy Decision, we rely on Standard Contractual Clauses with the recipient and take supplementary security measures to secure this data transfer, such as anonymisation.

 

Physical security

The data centres on which personal data is hosted are secured and monitored 24/7 and physical access to facilities is strictly limited to select staff.

 

Technical security measures

All devices which are used to access personal data for which we are responsible are secured with antivirus software, firewalls, encryption, and access management. We regularly update operating systems and software to ensure vulnerabilities cannot be exploited.

We carry out regular vulnerability scanning of our website and have engaged credentialed external auditors to verify the adequacy of our security and privacy measures.

 

Your rights regarding information

Each data subject has the right to information on and access to, and rectification, erasure and restriction of processing of their personal data, as well as the right to object to the processing and the right to data portability. You also have the right to request that you are not made subject to decision making based solely on automated processes, including profiling, if these decisions would have a significant effect on you.

You can exercise these rights by contacting us at the following email address: contact@oxfordbraindiagnostics.com. If we have any doubts as to your identity, we may request you to provide us with proof of identification, such as through sending us a copy of your valid ID. Ensure that you write “Data Request” in the subject line of your email.

Within one month of the submitted request, you will receive an answer from us. We will not charge you for submitting your request unless the request is manifestly unfounded or otherwise unreasonable in its nature. Depending on the complexity and the number of the requests this period may be extended to two months.

 

Marketing
  • You may receive commercial offers from Oxford Brain Diagnostics. If you do not wish to receive them, you have the right to opt out using the 'unsubscribe' link provided at the bottom of each marketing email, or send us an email to the following address: contact@oxfordbraindiagnostics.com and ensure that you write “Data Opt-Out” in the subject line of your email.
  • Your personal data will not be used by our partners for commercial purposes.
  • If you encounter any personal data from other data subjects while visiting our website, you are to refrain from collection, any unauthorized use or any other act that constitutes an infringement of the privacy of the data subject(s) in question. The collector is not responsible in these circumstances.

 

Data retention

The collected data are used and retained for the duration determined by law. You may, at any time, request your data to be deleted from any Oxford Brain Diagnostics account, system or other data processing medium in accordance with the process described above.

 

Applicable law

These conditions are governed by the laws and regulations of the country where we are headquartered. The court in the district where we are headquartered has the sole jurisdiction if any dispute regarding these conditions may arise, save when a legal exception applies.

 

Children's data

We do not knowingly process children's data, unless specifically stated in this Privacy Policy. If you have concerns about or knowledge of a child using our services, products, websites or apps without parental consent, please contact our DPO via terry.pollard@oxfordbraindiagnostics.com to ensure we can take appropriate action as soon as possible.

 

Contact

For questions about this privacy policy, product information or information about the website itself, please contact: contact@oxfordbraindiagnostics.com.

 

Third Party Applications

AWS

Third party headquarter address 410 Terry Ave. North, Seattle, WA, 98109-5210, United States of America
The primary location of processing is the United States of America Personal data collected by AWS may be stored and processed in any country where AWS or its affiliates, subsidiaries, or service providers operate facilities.
Safeguards (art. 45 GDPR) Adequacy decision exists between United Kingdom and United States of America
Additional safeguards
  • Encryption
  • Anonymisation where possible
  • Pseudonymisation where possible
For more information see AWS's Privacy Policy https://aws.amazon.com/privacy/

 

Google Cloud

Third party headquarter address 1602 Amphitheatre Parkway, Mountain View, CA 94043, United States of America
The primary location of processing is the United States of America Personal data collected by Google Cloud may be stored and processed in any country where Google Cloud or its affiliates, subsidiaries, or service providers operate facilities.
Safeguards (art. 45 GDPR) Adequacy decision exists between United Kingdom and United States of America
Additional safeguards
  • Encryption
  • Anonymisation where possible
  • Pseudonymisation where possible
For more information see Google Cloud's Privacy Policy https://cloud.google.com/privacy

 

Microsoft Outlook/Sharepoint

Third party headquarter address 1 Microsoft Way, Redmond, WA 98052-6399, United States of America
The primary location of processing is the United States of America Personal data collected by Microsoft may be stored and processed in any country where Microsoft or its affiliates, subsidiaries, or service providers operate facilities.
Safeguards (art. 45 GDPR) Adequacy decision exists between United Kingdom and United States of America
Additional safeguards
  • Encryption
  • Anonymisation where possible
  • Pseudonymisation where possible
For more information see Microsoft Sharepoint's Privacy Policy https://privacy.microsoft.com/en-ca/privacystatement

 

Xero

Third party headquarter address 19–23 Taranaki Street, Te Aro, Wellington 6011, New Zealand
The primary location of processing is New Zealand Personal data collected by Xero may be stored and processed in any country where Xero or its affiliates, subsidiaries, or service providers operate facilities.
Safeguards (art. 45 GDPR) Adequacy decision exists between United Kingdom and New Zealand
Additional safeguards
  • Encryption
  • Anonymisation where possible
  • Pseudonymisation where possible
For more information see Xero's Privacy Policy https://www.xero.com/uk/legal/privacy/

 

Zoho

Third party headquarter address Beneluxlaan 4B, 3527 HT Utrecht, Nederland, The Netherlands
The primary location of processing is The Netherlands Personal data collected by Zoho may be stored and processed in any country where Zoho or its affiliates, subsidiaries, or service providers operate facilities.
Safeguards (art. 45 GDPR) Adequacy decision exists between United Kingdom and The Netherlands
Additional safeguards
  • Encryption
  • Anonymisation where possible
  • Pseudonymisation where possible
For more information see Zoho's Privacy Policy https://www.zoho.com/privacy.html

 

Suppliers

Redbrick AI

Third party headquarter address Claymonth, Delaware, United States of America
The primary location of processing is the United States of America Personal data collected by Redbrick AI may be stored and processed in any country where Redbrick AI or its affiliates, subsidiaries, or service providers operate facilities.
Safeguards (art. 45 GDPR) Adequacy decision exists between United Kingdom and United States of America
Additional safeguards
  • Encryption
  • Anonymisation where possible
  • Pseudonymisation where possible
For more information see Redbrick AI's Privacy Policy https://redbrickai.com/policies/privacy.pdf